- Maintain a register of keys and badges with named holders; reconcile it on a cadence and at every termination.
- Define the response to a lost device before it happens — deactivate the badge, rekey the lock, change the combination — and record when it was done.
- Master keys and landlord or building-management access deserve specific attention in shared and leased facilities.
3.10.5OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.10.5 — Physical access device control
3.10 Physical Protection · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Control and manage physical access devices.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Keys, badges, fobs, and lock combinations are credentials in physical form. The organization knows what exists, who holds each one, recovers them at departure, and rekeys or deactivates when one goes missing rather than hoping.
Across revisions
Rev. 3 withdraws the standalone slot (03.10.05); access-device management folds into Physical Access Control, 03.10.07.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- The access-device register reconciled against current holders
- Recovery records tied to terminations
- Rekey or deactivation records for lost and unreturned devices
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |